urlscan.io logo urlscan.io
SecurityTrails logo

valleyobgynassociates.com Open in urlscan Pro
34.70.153.112  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://valleyobgynassociates.com/wp-content/vp2/
Submission Tags: @jcybersec_
Submission: On May 26 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 34.70.153.112, located in United States and belongs to GOOGLE, US. The main domain is valleyobgynassociates.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 21st 2020. Valid for: 3 months.
This is the only time valleyobgynassociates.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: IRS (Government)

Domain & IP information

IP Address AS Autonomous System
7 34.70.153.112 15169 (GOOGLE)
7 1
Apex Domain
Subdomains		 Transfer
7 valleyobgynassociates.com
valleyobgynassociates.com
102 KB
7 1
Domain Requested by
7 valleyobgynassociates.com valleyobgynassociates.com
7 1

This site contains no links.

Subject Issuer Validity Valid
valleyobgynassociates.com
Let's Encrypt Authority X3		 2020-03-21 -
2020-06-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://valleyobgynassociates.com/wp-content/vp2/
Frame ID: D2CD21D6EDA42938F2145943CC4BEB24
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

102 kB
Transfer

604 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
valleyobgynassociates.com/wp-content/vp2/ 		21 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://valleyobgynassociates.com/wp-content/vp2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.70.153.112 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
112.153.70.34.bc.googleusercontent.com
Software
nginx / WP Engine
Resource Hash
8a04579eeab55a66fc702a212f2a6a9eb9fa5e625495bcfa784b71dfbb8da5ea

Request headers

:method
GET
:authority
valleyobgynassociates.com
:scheme
https
:path
/wp-content/vp2/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
server
nginx
date
Tue, 26 May 2020 23:39:46 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-powered-by
WP Engine
x-cacheable
SHORT
cache-control
max-age=600, must-revalidate
x-cache
HIT: 9
x-cache-group
normal
content-encoding
br
style.css
valleyobgynassociates.com/wp-content/vp2/template/ 		541 KB
70 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://valleyobgynassociates.com/wp-content/vp2/template/style.css
Requested by
Host: valleyobgynassociates.com
URL: https://valleyobgynassociates.com/wp-content/vp2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.70.153.112 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
112.153.70.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
dd0ef53cb8a1680cde5b66908e679ff04c8d158a3dc7dd93eb6609465249e288

Request headers

Referer
https://valleyobgynassociates.com/wp-content/vp2/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:39:46 GMT
content-encoding
br
last-modified
Mon, 07 Oct 2019 18:14:48 GMT
server
nginx
status
200
etag
W/"5d9b8098-87258"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
logo.svg
valleyobgynassociates.com/wp-content/vp2/template/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://valleyobgynassociates.com/wp-content/vp2/template/logo.svg
Requested by
Host: valleyobgynassociates.com
URL: https://valleyobgynassociates.com/wp-content/vp2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.70.153.112 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
112.153.70.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
a884ef158c7bd10ad3b20f6aacc050c49f1f7eb4d411e2cdec000bf574f2fb77

Request headers

Referer
https://valleyobgynassociates.com/wp-content/vp2/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:39:46 GMT
content-encoding
br
last-modified
Mon, 07 Oct 2019 18:14:48 GMT
server
nginx
status
200
etag
W/"5d9b8098-1368"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
logo-print.svg
valleyobgynassociates.com/wp-content/vp2/template/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://valleyobgynassociates.com/wp-content/vp2/template/logo-print.svg
Requested by
Host: valleyobgynassociates.com
URL: https://valleyobgynassociates.com/wp-content/vp2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.70.153.112 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
112.153.70.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
66466573e4c2cffdc636e13e76758dcf83f0ce235083c2098ad471cf419481d8

Request headers

Referer
https://valleyobgynassociates.com/wp-content/vp2/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:39:46 GMT
content-encoding
br
last-modified
Mon, 07 Oct 2019 18:14:48 GMT
server
nginx
status
200
etag
W/"5d9b8098-14f0"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
AmericanFlagPROD.jpg
valleyobgynassociates.com/wp-content/vp2/template/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://valleyobgynassociates.com/wp-content/vp2/template/AmericanFlagPROD.jpg
Requested by
Host: valleyobgynassociates.com
URL: https://valleyobgynassociates.com/wp-content/vp2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.70.153.112 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
112.153.70.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
a36294042f5ac80a2cc3d524d9de48986671b904259fbb86f94b3b503dcbe6a6

Request headers

Referer
https://valleyobgynassociates.com/wp-content/vp2/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:39:46 GMT
last-modified
Mon, 07 Oct 2019 18:14:48 GMT
server
nginx
status
200
etag
"5d9b8098-4778"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
18296
irs_horiz-01.svg
valleyobgynassociates.com/wp-content/vp2/template/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://valleyobgynassociates.com/wp-content/vp2/template/irs_horiz-01.svg
Requested by
Host: valleyobgynassociates.com
URL: https://valleyobgynassociates.com/wp-content/vp2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.70.153.112 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
112.153.70.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
fce0cd497fe165fa8b2696694dbcace77f7b7e42866de177ecf1d897cbd083be

Request headers

Referer
https://valleyobgynassociates.com/wp-content/vp2/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:39:46 GMT
content-encoding
br
last-modified
Mon, 07 Oct 2019 18:14:48 GMT
server
nginx
status
200
etag
W/"5d9b8098-13fc"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
irs_horiz_logo.svg
valleyobgynassociates.com/wp-content/vp2/template/ 		10 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://valleyobgynassociates.com/wp-content/vp2/template/irs_horiz_logo.svg
Requested by
Host: valleyobgynassociates.com
URL: https://valleyobgynassociates.com/wp-content/vp2/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.70.153.112 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
112.153.70.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
821f19aff55b1e8c6a258efe357f8fd9bd4c58991650c8afcb7a6efef85412c9

Request headers

Referer
https://valleyobgynassociates.com/wp-content/vp2/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 26 May 2020 23:39:46 GMT
content-encoding
br
last-modified
Mon, 07 Oct 2019 18:14:48 GMT
server
nginx
status
200
etag
W/"5d9b8098-265d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: IRS (Government)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies